Overview

overview

7

Static

static

3

UltraViewe...en.exe

windows10-2004-x64

7

UltraViewe...en.exe

windows11-ltsc_2024-x64

7

Resubmissions

23/06/2026, 06:43

260623-hg6wtsbs517

23/06/2026, 04:46

260623-fedfdsat2j7

23/06/2026, 04:27

260623-e3c9vsaw5x7

23/06/2026, 02:53

260623-ddqm8aat617

23/06/2026, 02:20

260623-csmz7sat2s7

Analysis

  • user interaction
    yes
  • max time kernel
    1799s
  • max time network
    1796s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    23/06/2026, 04:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    UltraViewer_setup_6.6.124_en.exe
  • Size 3.5MB
  • Sample260623-fedfdsat2j
  • SHA256 020aac79a14717e316a593155ca778dd3e253b888bf62633b174838d35df7f41
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarebootkitdefense_evasiondiscoveryexecutioninstallerpersistencespywaretrojanupx

Malware Config

Signatures

  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 44 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 11 IoCs
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Discovers systems in the same network 1 TTPs 2 IoCs
    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 64 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 40 IoCs
  • Suspicious use of SendNotifyMessage 36 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\UltraViewer_setup_6.6.124_en.exe
    "C:\Users\Admin\AppData\Local\Temp\UltraViewer_setup_6.6.124_en.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4144
    • C:\Users\Admin\AppData\Local\Temp\is-BEBS1.tmp\UltraViewer_setup_6.6.124_en.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-BEBS1.tmp\UltraViewer_setup_6.6.124_en.tmp" /SL5="$60110,3238183,121344,C:\Users\Admin\AppData\Local\Temp\UltraViewer_setup_6.6.124_en.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4624
      • C:\Users\Admin\AppData\Local\Temp\is-B13UV.tmp\UVUninstallHelper.exe
        "C:\Users\Admin\AppData\Local\Temp\is-B13UV.tmp\UVUninstallHelper.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:540
      • C:\Windows\SysWOW64\net.exe
        "net" stop UltraViewService
        3⤵
        • Discovers systems in the same network
        • Suspicious use of WriteProcessMemory
        PID:3384
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop UltraViewService
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2368
      • C:\Windows\SysWOW64\net.exe
        "net" stop UltraViewService
        3⤵
        • Discovers systems in the same network
        • Suspicious use of WriteProcessMemory
        PID:4216
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop UltraViewService
          4⤵
            PID:4976
        • C:\Windows\SysWOW64\sc.exe
          "sc" delete UltraViewService
          3⤵
          • Launches sc.exe
          PID:3944
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4588
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4404
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2228
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2956
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2732
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1496
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3184
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4348
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3892
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:416
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:928
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:472
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3256
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4492
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3612
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2796
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4056
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:832
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3464
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4812
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • Kills process with taskkill
          PID:1084
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3712
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2360
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1552
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4136
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1232
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3840
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1508
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3156
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1300
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1240
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2808
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4056
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1296
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3240
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4812
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2564
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3712
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1716
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5048
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3892
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1292
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3840
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1508
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3204
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3720
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4608
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3508
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3760
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2964
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1032
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1768
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3684
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4736
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1352
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1756
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1828
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4960
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5096
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3932
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4492
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3612
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1996
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4444
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
          3⤵
          • Kills process with taskkill
          PID:3928
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill.exe" /f /im "UltraViewer_Service.exe"
          3⤵
            PID:4616
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
            3⤵
            • Kills process with taskkill
            PID:1036
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "UltraViewer_Service.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4924
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
            3⤵
              PID:1744
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Service.exe"
              3⤵
                PID:4376
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                3⤵
                  PID:5048
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /f /im "UltraViewer_Service.exe"
                  3⤵
                    PID:3284
                  • C:\Windows\SysWOW64\taskkill.exe
                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                    3⤵
                      PID:824
                    • C:\Windows\SysWOW64\taskkill.exe
                      "taskkill.exe" /f /im "UltraViewer_Service.exe"
                      3⤵
                        PID:4080
                      • C:\Windows\SysWOW64\taskkill.exe
                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                        3⤵
                        • Kills process with taskkill
                        PID:3964
                      • C:\Windows\SysWOW64\taskkill.exe
                        "taskkill.exe" /f /im "UltraViewer_Service.exe"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:1728
                      • C:\Windows\SysWOW64\taskkill.exe
                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                        3⤵
                        • Kills process with taskkill
                        PID:4168
                      • C:\Windows\SysWOW64\taskkill.exe
                        "taskkill.exe" /f /im "UltraViewer_Service.exe"
                        3⤵
                          PID:3368
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                          3⤵
                          • Kills process with taskkill
                          PID:2732
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /f /im "UltraViewer_Service.exe"
                          3⤵
                            PID:2140
                          • C:\Windows\SysWOW64\taskkill.exe
                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Kills process with taskkill
                            PID:3868
                          • C:\Windows\SysWOW64\taskkill.exe
                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                            3⤵
                              PID:4436
                            • C:\Windows\SysWOW64\taskkill.exe
                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                              3⤵
                                PID:1032
                              • C:\Windows\SysWOW64\taskkill.exe
                                "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                3⤵
                                • Kills process with taskkill
                                PID:4040
                              • C:\Windows\SysWOW64\taskkill.exe
                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                3⤵
                                  PID:4020
                                • C:\Windows\SysWOW64\taskkill.exe
                                  "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  • Kills process with taskkill
                                  PID:3484
                                • C:\Windows\SysWOW64\taskkill.exe
                                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                  3⤵
                                  • Kills process with taskkill
                                  PID:2136
                                • C:\Windows\SysWOW64\taskkill.exe
                                  "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  • Kills process with taskkill
                                  PID:3956
                                • C:\Windows\SysWOW64\taskkill.exe
                                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                  3⤵
                                    PID:1412
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                    3⤵
                                    • Kills process with taskkill
                                    PID:3440
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                    3⤵
                                      PID:3736
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                      3⤵
                                      • Kills process with taskkill
                                      PID:3232
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                      3⤵
                                        PID:3608
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                        3⤵
                                          PID:4976
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                          3⤵
                                            PID:1240
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                            3⤵
                                              PID:4812
                                            • C:\Windows\SysWOW64\taskkill.exe
                                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                              3⤵
                                                PID:3208
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                3⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:3556
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                3⤵
                                                  PID:896
                                                • C:\Windows\SysWOW64\taskkill.exe
                                                  "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                  3⤵
                                                  • Kills process with taskkill
                                                  PID:3936
                                                • C:\Windows\SysWOW64\taskkill.exe
                                                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                  3⤵
                                                    PID:2768
                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                    "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                    3⤵
                                                      PID:3024
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1716
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:3940
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Kills process with taskkill
                                                      PID:1052
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                      3⤵
                                                        PID:4968
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                        3⤵
                                                          PID:4508
                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                          "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4728
                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:936
                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                          "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3840
                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Kills process with taskkill
                                                          PID:216
                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                          "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                          3⤵
                                                            PID:2656
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:3760
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:612
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                            3⤵
                                                              PID:4212
                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                              "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                              3⤵
                                                                PID:3904
                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                3⤵
                                                                • Kills process with taskkill
                                                                PID:2964
                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                3⤵
                                                                  PID:5060
                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                  3⤵
                                                                  • Kills process with taskkill
                                                                  PID:1724
                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                  "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                  3⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Kills process with taskkill
                                                                  PID:4040
                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                  3⤵
                                                                    PID:1616
                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                    "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                    3⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Kills process with taskkill
                                                                    PID:4504
                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                    3⤵
                                                                      PID:3892
                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                      "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                      3⤵
                                                                        PID:3828
                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                        3⤵
                                                                          PID:3340
                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                          "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                          3⤵
                                                                            PID:3636
                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                            3⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:3788
                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                            3⤵
                                                                              PID:1284
                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1300
                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                              "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                              3⤵
                                                                                PID:2256
                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                3⤵
                                                                                • Kills process with taskkill
                                                                                PID:4564
                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                3⤵
                                                                                  PID:2732
                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                  3⤵
                                                                                    PID:1452
                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                    "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                    3⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Kills process with taskkill
                                                                                    PID:4212
                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                    3⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Kills process with taskkill
                                                                                    PID:4444
                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                    "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                    3⤵
                                                                                      PID:3784
                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                      3⤵
                                                                                        PID:1496
                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                        "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                        3⤵
                                                                                          PID:1420
                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                          3⤵
                                                                                            PID:912
                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                            3⤵
                                                                                            • Kills process with taskkill
                                                                                            PID:2116
                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                            3⤵
                                                                                            • Kills process with taskkill
                                                                                            PID:3976
                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                            3⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:1352
                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                            3⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:3300
                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                            3⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:1232
                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                            3⤵
                                                                                              PID:4312
                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                              "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                              3⤵
                                                                                                PID:792
                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                3⤵
                                                                                                  PID:520
                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                  "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                  3⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Kills process with taskkill
                                                                                                  PID:4168
                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                  3⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:4712
                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                  "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                  3⤵
                                                                                                    PID:1856
                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                    3⤵
                                                                                                      PID:2732
                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                      "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                      3⤵
                                                                                                        PID:2948
                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                        3⤵
                                                                                                          PID:3904
                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                          "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                          3⤵
                                                                                                            PID:4444
                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                            3⤵
                                                                                                            • Kills process with taskkill
                                                                                                            PID:3936
                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                            3⤵
                                                                                                              PID:2852
                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                              3⤵
                                                                                                                PID:3184
                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                3⤵
                                                                                                                  PID:4380
                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                  3⤵
                                                                                                                    PID:4504
                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                    "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                    3⤵
                                                                                                                      PID:3876
                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                      3⤵
                                                                                                                        PID:3828
                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                        "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                        3⤵
                                                                                                                        • Kills process with taskkill
                                                                                                                        PID:684
                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                        3⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Kills process with taskkill
                                                                                                                        PID:3252
                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                        "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                        3⤵
                                                                                                                          PID:3788
                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                          3⤵
                                                                                                                            PID:4964
                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                            3⤵
                                                                                                                              PID:1784
                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                              3⤵
                                                                                                                                PID:4492
                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                3⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:1668
                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                3⤵
                                                                                                                                • Kills process with taskkill
                                                                                                                                PID:612
                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                3⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:4524
                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                3⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:3556
                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                3⤵
                                                                                                                                • Kills process with taskkill
                                                                                                                                PID:896
                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                3⤵
                                                                                                                                  PID:572
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                  3⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:2504
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                  3⤵
                                                                                                                                    PID:2964
                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                    "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                    3⤵
                                                                                                                                      PID:3184
                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                      3⤵
                                                                                                                                        PID:3696
                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                        "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                        3⤵
                                                                                                                                        • Kills process with taskkill
                                                                                                                                        PID:2136
                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                        3⤵
                                                                                                                                          PID:1896
                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                          "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                          3⤵
                                                                                                                                            PID:4188
                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                            3⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            • Kills process with taskkill
                                                                                                                                            PID:984
                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                            3⤵
                                                                                                                                            • Kills process with taskkill
                                                                                                                                            PID:3232
                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                            3⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:4060
                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                            3⤵
                                                                                                                                            • Kills process with taskkill
                                                                                                                                            PID:4472
                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                            3⤵
                                                                                                                                              PID:1332
                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                              "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                              3⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:4152
                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                              3⤵
                                                                                                                                                PID:3368
                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                3⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:1856
                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                3⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Kills process with taskkill
                                                                                                                                                PID:4644
                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                3⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Kills process with taskkill
                                                                                                                                                PID:3432
                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                3⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Kills process with taskkill
                                                                                                                                                PID:4888
                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                3⤵
                                                                                                                                                • Kills process with taskkill
                                                                                                                                                PID:3092
                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                3⤵
                                                                                                                                                  PID:1696
                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                  "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                  3⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:2872
                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                  3⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:1724
                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                  "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                  3⤵
                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                  PID:3752
                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                  3⤵
                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                  PID:3976
                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                  "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                  3⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:2344
                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl.dll" /tlb
                                                                                                                                                  3⤵
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  • Modifies registry class
                                                                                                                                                  PID:4508
                                                                                                                                                • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                                                                                                                                  "C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" validate
                                                                                                                                                  3⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:4200
                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" "C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll" /tlb
                                                                                                                                                  3⤵
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  • Modifies registry class
                                                                                                                                                  PID:4988
                                                                                                                                                • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                                                                                                                                  "C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" install
                                                                                                                                                  3⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:4920
                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                    sc failure "UltraViewService" reset= 0 actions= restart/60000
                                                                                                                                                    4⤵
                                                                                                                                                    • Launches sc.exe
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:3160
                                                                                                                                                • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                                                                                                                                  "C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" regasm40
                                                                                                                                                  3⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:3216
                                                                                                                                                • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                                                                                                                                  "C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe"
                                                                                                                                                  3⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:4900
                                                                                                                                            • C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe
                                                                                                                                              "C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe"
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Writes to the Master Boot Record (MBR)
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                              PID:4808
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl40.dll" /tlb /codebase
                                                                                                                                                2⤵
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                PID:2604
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl40.dll" /tlb /codebase
                                                                                                                                                2⤵
                                                                                                                                                  PID:2132
                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl40.dll" /tlb /codebase
                                                                                                                                                  2⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:4080
                                                                                                                                                • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                                                                                                                                  UltraViewer_Desktop.exe -pid:4900 -debughwnd:-1
                                                                                                                                                  2⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:4712
                                                                                                                                                • C:\Program Files (x86)\UltraViewer\uv_x64.exe
                                                                                                                                                  uv_x64.exe hook 4900 197246
                                                                                                                                                  2⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  • Modifies system certificate store
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:3616
                                                                                                                                              • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                C:\Windows\system32\AUDIODG.EXE 0x4f8 0x46c
                                                                                                                                                1⤵
                                                                                                                                                  PID:416
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                  1⤵
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  • Modifies registry class
                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                  PID:1452
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa91b2c728,0x7ffa91b2c734,0x7ffa91b2c740
                                                                                                                                                    2⤵
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    PID:208
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2168,i,3657945995059979868,15146083824377527969,524288 --field-trial-handle=2052,i,16819166577983894587,7875232189919922895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2188 /prefetch:3
                                                                                                                                                    2⤵
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • System Time Discovery
                                                                                                                                                    PID:3588
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1812,i,6540432730972784578,15656881469423546843,262144 --field-trial-handle=2052,i,16819166577983894587,7875232189919922895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2036 /prefetch:2
                                                                                                                                                    2⤵
                                                                                                                                                      PID:3836
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2452,i,282780724362133809,18378478210198010945,524288 --field-trial-handle=2052,i,16819166577983894587,7875232189919922895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2484 /prefetch:8
                                                                                                                                                      2⤵
                                                                                                                                                        PID:928
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3308,i,10416070296103673232,14590790183906099011,2097152 --field-trial-handle=2052,i,16819166577983894587,7875232189919922895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:1
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1728
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3504,i,10600084446732751341,18330547955937079816,2097152 --field-trial-handle=2052,i,16819166577983894587,7875232189919922895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3096 /prefetch:1
                                                                                                                                                          2⤵
                                                                                                                                                            PID:4236
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4612,i,7931930595903115383,12811626177973395032,2097152 --field-trial-handle=2052,i,16819166577983894587,7875232189919922895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1804 /prefetch:1
                                                                                                                                                            2⤵
                                                                                                                                                              PID:3852
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4764,i,6033313437405468622,8117487489152127150,524288 --field-trial-handle=2052,i,16819166577983894587,7875232189919922895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:8
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1652
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4916,i,10645086769792599520,10020995102223744407,524288 --field-trial-handle=2052,i,16819166577983894587,7875232189919922895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4924 /prefetch:8
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:4976
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4784,i,13348291465196590743,7678850133558782279,524288 --field-trial-handle=2052,i,16819166577983894587,7875232189919922895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4768 /prefetch:8
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:3864
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,14455231693176761335,8950321750768484583,524288 --field-trial-handle=2052,i,16819166577983894587,7875232189919922895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5332 /prefetch:8
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                    PID:2256
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,15917623710144725609,17373536518916513145,524288 --field-trial-handle=2052,i,16819166577983894587,7875232189919922895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5472 /prefetch:8
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:840
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:1900
                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:936
                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:2556

                                                                                                                                                                        Network

                                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                                              Reconnaissance

                                                                                                                                                                              Resource Development

                                                                                                                                                                              Initial Access

                                                                                                                                                                              Execution

                                                                                                                                                                              System Services

                                                                                                                                                                              1
                                                                                                                                                                              T1569

                                                                                                                                                                              Service Execution

                                                                                                                                                                              1
                                                                                                                                                                              T1569.002

                                                                                                                                                                              Persistence

                                                                                                                                                                              Create or Modify System Process

                                                                                                                                                                              1
                                                                                                                                                                              T1543

                                                                                                                                                                              Windows Service

                                                                                                                                                                              1
                                                                                                                                                                              T1543.003

                                                                                                                                                                              Pre-OS Boot

                                                                                                                                                                              1
                                                                                                                                                                              T1542

                                                                                                                                                                              Bootkit

                                                                                                                                                                              1
                                                                                                                                                                              T1542.003

                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                              Create or Modify System Process

                                                                                                                                                                              1
                                                                                                                                                                              T1543

                                                                                                                                                                              Windows Service

                                                                                                                                                                              1
                                                                                                                                                                              T1543.003

                                                                                                                                                                              Defense Evasion

                                                                                                                                                                              Impair Defenses

                                                                                                                                                                              1
                                                                                                                                                                              T1562

                                                                                                                                                                              Modify Registry

                                                                                                                                                                              2
                                                                                                                                                                              T1112

                                                                                                                                                                              Pre-OS Boot

                                                                                                                                                                              1
                                                                                                                                                                              T1542

                                                                                                                                                                              Bootkit

                                                                                                                                                                              1
                                                                                                                                                                              T1542.003

                                                                                                                                                                              Subvert Trust Controls

                                                                                                                                                                              1
                                                                                                                                                                              T1553

                                                                                                                                                                              Install Root Certificate

                                                                                                                                                                              1
                                                                                                                                                                              T1553.004

                                                                                                                                                                              Credential Access

                                                                                                                                                                              Discovery

                                                                                                                                                                              Browser Information Discovery

                                                                                                                                                                              1
                                                                                                                                                                              T1217

                                                                                                                                                                              Network Share Discovery

                                                                                                                                                                              1
                                                                                                                                                                              T1135

                                                                                                                                                                              Query Registry

                                                                                                                                                                              3
                                                                                                                                                                              T1012

                                                                                                                                                                              Remote System Discovery

                                                                                                                                                                              1
                                                                                                                                                                              T1018

                                                                                                                                                                              System Information Discovery

                                                                                                                                                                              3
                                                                                                                                                                              T1082

                                                                                                                                                                              System Location Discovery

                                                                                                                                                                              1
                                                                                                                                                                              T1614

                                                                                                                                                                              System Language Discovery

                                                                                                                                                                              1
                                                                                                                                                                              T1614.001

                                                                                                                                                                              System Time Discovery

                                                                                                                                                                              1
                                                                                                                                                                              T1124

                                                                                                                                                                              Lateral Movement

                                                                                                                                                                              Collection

                                                                                                                                                                              Command and Control

                                                                                                                                                                              Exfiltration

                                                                                                                                                                              Impact

                                                                                                                                                                              Service Stop

                                                                                                                                                                              1
                                                                                                                                                                              T1489

                                                                                                                                                                              Replay Monitor

                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                              Downloads

                                                                                                                                                                              HtmlAgilityPack.dll
                                                                                                                                                                              • Path C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll
                                                                                                                                                                              • Size 130KB
                                                                                                                                                                              • SHA256 78750e7bd53ed088d8365fc2e69b74883a813b0ea0d461873ad61fd8059dbd31
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              Language.ini
                                                                                                                                                                              • Path C:\Program Files (x86)\UltraViewer\Language.ini
                                                                                                                                                                              • Size 2B
                                                                                                                                                                              • SHA256 dbd3a49d0d906b4ed9216b73330d2fb080ef2f758c12f3885068222e5e17151c
                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                              Submit Download

                                                                                                                                                                              English.txt
                                                                                                                                                                              • Path C:\Program Files (x86)\UltraViewer\Language\English.txt
                                                                                                                                                                              • Size 15KB
                                                                                                                                                                              • SHA256 9c7ec44c1ae68623d3d9a6ae040b126a917e4b766a05c457b06a3e49e2ef235f
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              LanguageList.ini
                                                                                                                                                                              • Path C:\Program Files (x86)\UltraViewer\Language\LanguageList.ini
                                                                                                                                                                              • Size 1KB
                                                                                                                                                                              • SHA256 30b1a2e3b1f3d5c25b617438d9c24c492f292c6059a8de02ff5e0666e4d9a3f6
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              NAudio.dll
                                                                                                                                                                              • Path C:\Program Files (x86)\UltraViewer\NAudio.dll
                                                                                                                                                                              • Size 496KB
                                                                                                                                                                              • SHA256 92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              RemoteControl.dll
                                                                                                                                                                              • Path C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                                                                                                                                                                              • Size 1.1MB
                                                                                                                                                                              • SHA256 a970011da934efbe08e9336cba785ebe88fb6bb6f82211a1c4bad62eb0a9a283
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              RemoteControl.tlb
                                                                                                                                                                              • Path C:\Program Files (x86)\UltraViewer\RemoteControl.tlb
                                                                                                                                                                              • Size 256KB
                                                                                                                                                                              • SHA256 bc6eb31ae4992f21f98ada3918a018a00c658df9798f862f4bd36138e141931f
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              UltraViewer_Desktop.exe
                                                                                                                                                                              • Path C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                                                                                                                                                              • Size 1022KB
                                                                                                                                                                              • SHA256 23dfe3c02f083bae6e8a8aab0d7b96f9961c930f9208b48e6245033105b58afa
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              UltraViewer_Desktop.exe.config
                                                                                                                                                                              • Path C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe.config
                                                                                                                                                                              • Size 310B
                                                                                                                                                                              • SHA256 99f95d44f1e42cf485132e722679f9d0c6f6cd5f560ce76dfd98abf8558377bc
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              UltraViewer_Service.exe
                                                                                                                                                                              • Path C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe
                                                                                                                                                                              • Size 235KB
                                                                                                                                                                              • SHA256 1809068550d615bd78bdd3618cf3ab13c35e67102013cf2ef0f316684d80781c
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              collapse.png
                                                                                                                                                                              • Path C:\Program Files (x86)\UltraViewer\images\collapse.png
                                                                                                                                                                              • Size 241B
                                                                                                                                                                              • SHA256 98b57c75342ade59637e98fa89ae4916fed98553a894d58be47e67251ff03d10
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              copy-icon.png
                                                                                                                                                                              • Path C:\Program Files (x86)\UltraViewer\images\copy-icon.png
                                                                                                                                                                              • Size 966B
                                                                                                                                                                              • SHA256 a3bd36292ce983a166f6968ac78554bda2a8f664141f7061c1e3d865367a2b68
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              reload-icon.png
                                                                                                                                                                              • Path C:\Program Files (x86)\UltraViewer\images\reload-icon.png
                                                                                                                                                                              • Size 689B
                                                                                                                                                                              • SHA256 c9916449e962acb841d7404147051c07869cd1a831dc99674b9f17b46d09b131
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              msvbvm60.dll
                                                                                                                                                                              • Path C:\Program Files (x86)\UltraViewer\msvbvm60.dll
                                                                                                                                                                              • Size 1.3MB
                                                                                                                                                                              • SHA256 2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              uvc.dll
                                                                                                                                                                              • Path C:\Program Files (x86)\UltraViewer\uvc.dll
                                                                                                                                                                              • Size 671KB
                                                                                                                                                                              • SHA256 309a37ff0c07524d0804a6d0d7719fb1a3ad893c03552446f4617a7dc2c7f90d
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              uvh.dll
                                                                                                                                                                              • Path C:\Program Files (x86)\UltraViewer\uvh.dll
                                                                                                                                                                              • Size 124KB
                                                                                                                                                                              • SHA256 09ab11cb97673838faf91b8d06ed9ff7ad460d7791715ee983b83004984a452c
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              BookmarkMergedSurfaceOrdering
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                                              • Size 6B
                                                                                                                                                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                              Submit Download

                                                                                                                                                                              BrowsingTopicsState
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                                                              • Size 414B
                                                                                                                                                                              • SHA256 2427caf6f2ec14ddcb918d5955a47e10fca17335387a2abd4c5883bfaf4ce614
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              Network Persistent State
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                              • Size 1KB
                                                                                                                                                                              • SHA256 3091a1a50acf463605f47e9b27a10721e3ce0a3b55570f2b586fcd5b9c5d3ef3
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              SCT Auditing Pending Reports
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                              • Size 2B
                                                                                                                                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                              Submit Download

                                                                                                                                                                              TransportSecurity
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                              • Size 523B
                                                                                                                                                                              • SHA256 b5e21f10122aab5c4ad6a5dcad1cf1cdc7146449943d05f9be5efa3a67d46c42
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              Preferences
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                              • Size 10KB
                                                                                                                                                                              • SHA256 e2122251aaf2c5da92bf590021dd24c506400d7ec6030bf3fc580947b5773078
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              Secure Preferences
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                              • Size 11KB
                                                                                                                                                                              • SHA256 498f97e437f33607f49227f47060af99dd3d655dc025469f81584320021ecf40
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              Local State
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                              • Size 234KB
                                                                                                                                                                              • SHA256 ab8855772941714a696f62caabbee8fd543a08dfbf284bc3d0bb5a3727b7b673
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              Local State
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                              • Size 115KB
                                                                                                                                                                              • SHA256 c514881d58912d8905a3530e4424d3acbd3df6007de6ef5f8e54938456e41b54
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              data_1
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                                                                                                                                                                              • Size 264KB
                                                                                                                                                                              • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                              Submit Download

                                                                                                                                                                              UltraViewer_Desktop.exe.log
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\UltraViewer_Desktop.exe.log
                                                                                                                                                                              • Size 1KB
                                                                                                                                                                              • SHA256 b660cfa1d78e3d585e184c23a2cdd37749a2e1a8f37797fc96d9bc119036e023
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              regasm.exe.log
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\regasm.exe.log
                                                                                                                                                                              • Size 507B
                                                                                                                                                                              • SHA256 f1a3724670e3379318ec9c73f6f39058cab0ab013ba3cd90c047c3d701362310
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              chatlog.html
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\chatlog.html
                                                                                                                                                                              • Size 24KB
                                                                                                                                                                              • SHA256 fbab9b6066ba20a2dc17496b37df1d2bb883e943ac35904f2391cc7f8f37d30e
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              clientlist.html
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\clientlist.html
                                                                                                                                                                              • Size 5KB
                                                                                                                                                                              • SHA256 6820d113229b4e1a25b6239efb94fe68de60215714c3ca022421d074fbfc99d1
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              UVUninstallHelper.exe
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-B13UV.tmp\UVUninstallHelper.exe
                                                                                                                                                                              • Size 43KB
                                                                                                                                                                              • SHA256 801bbe7a174ca09bb029aedf54c3073d96c033fa01dcd68f4240983d2ad7cb6b
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              UVUninstallHelper.exe.config
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-B13UV.tmp\UVUninstallHelper.exe.config
                                                                                                                                                                              • Size 225B
                                                                                                                                                                              • SHA256 470ce4147bff777ebefc7ccc9e2d1bc5df203b727134fc90b0134bf3cdc7add4
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              idp.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-B13UV.tmp\idp.dll
                                                                                                                                                                              • Size 232KB
                                                                                                                                                                              • SHA256 54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              isxdl.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-B13UV.tmp\isxdl.dll
                                                                                                                                                                              • Size 121KB
                                                                                                                                                                              • SHA256 b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              UltraViewer_setup_6.6.124_en.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-BEBS1.tmp\UltraViewer_setup_6.6.124_en.tmp
                                                                                                                                                                              • Size 1.1MB
                                                                                                                                                                              • SHA256 b727418174ad4f929ad9206e4df51865def55c0d2874bda487cbae6f2946938d
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              jquery-1.9.1.js
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\jquery-1.9.1.js
                                                                                                                                                                              • Size 262KB
                                                                                                                                                                              • SHA256 7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              remoterlist.html
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\remoterlist.html
                                                                                                                                                                              • Size 4KB
                                                                                                                                                                              • SHA256 243010bc15c1c33003f1688466ba9e75f38ec369b43e3da7545021ccec0f4533
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              4d8b7c3f-dc44-44bf-bc1c-08053f24b5f3.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1452_1938847842\4d8b7c3f-dc44-44bf-bc1c-08053f24b5f3.tmp
                                                                                                                                                                              • Size 242KB
                                                                                                                                                                              • SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              RegAsm.exe.log
                                                                                                                                                                              • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
                                                                                                                                                                              • Size 42B
                                                                                                                                                                              • SHA256 d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b
                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                              Submit Download

                                                                                                                                                                              memory/540-27-0x0000000001460000-0x0000000001470000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/540-28-0x0000000074052000-0x0000000074054000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/3216-338-0x0000000000400000-0x0000000000854000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/3216-320-0x0000000000400000-0x0000000000854000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/3616-405-0x000000001D610000-0x000000001D6B6000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4144-18-0x0000000000400000-0x0000000000428000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4144-373-0x0000000000400000-0x0000000000428000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4144-0-0x0000000000400000-0x0000000000428000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4200-279-0x0000000006FE0000-0x000000000750C000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4200-269-0x0000000000400000-0x0000000000854000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4200-287-0x0000000000400000-0x0000000000854000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4200-282-0x0000000007670000-0x000000000767A000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4508-254-0x0000000005430000-0x00000000054CC000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4508-253-0x00000000052F0000-0x0000000005382000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4508-252-0x00000000058A0000-0x0000000005E44000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4508-249-0x00000000051C0000-0x00000000052E6000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4508-245-0x0000000000430000-0x0000000000442000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4508-259-0x00000000061B0000-0x0000000006232000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4508-255-0x0000000005390000-0x0000000005416000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4624-340-0x0000000000400000-0x000000000052D000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4624-128-0x0000000000400000-0x000000000052D000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4624-5-0x00000000021A0000-0x00000000021A1000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4624-15-0x0000000003370000-0x0000000003392000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4624-330-0x0000000000400000-0x000000000052D000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4624-20-0x00000000021A0000-0x00000000021A1000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4624-19-0x0000000000400000-0x000000000052D000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4624-44-0x0000000000400000-0x000000000052D000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4624-88-0x0000000000400000-0x000000000052D000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4624-268-0x0000000000400000-0x000000000052D000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4624-206-0x0000000000400000-0x000000000052D000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4624-166-0x0000000000400000-0x000000000052D000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4624-372-0x0000000000400000-0x000000000052D000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4712-467-0x0000000000400000-0x0000000000854000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4712-468-0x0000000002FE0000-0x000000000308B000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4712-517-0x0000000002FE0000-0x000000000308B000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4712-485-0x0000000002FE0000-0x000000000308B000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4712-710-0x0000000002FE0000-0x000000000308B000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4712-533-0x0000000002FE0000-0x000000000308B000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4712-529-0x0000000002FE0000-0x000000000308B000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4900-472-0x00000000025A0000-0x000000000264B000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4900-789-0x00000000025A0000-0x000000000264B000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4900-502-0x0000000000400000-0x0000000000854000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4900-490-0x0000000000400000-0x0000000000854000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4900-526-0x0000000000400000-0x0000000000854000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4900-491-0x00000000025A0000-0x000000000264B000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4900-486-0x0000000000400000-0x0000000000854000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4900-563-0x00000000025A0000-0x000000000264B000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4900-562-0x0000000000400000-0x0000000000854000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4900-570-0x0000000000400000-0x0000000000854000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4900-487-0x00000000025A0000-0x000000000264B000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4900-744-0x0000000000400000-0x0000000000854000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4900-748-0x0000000000400000-0x0000000000854000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4900-494-0x0000000000400000-0x0000000000854000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4900-864-0x0000000000400000-0x0000000000854000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4900-868-0x0000000000400000-0x0000000000854000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4900-398-0x00000000118B0000-0x0000000012056000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4900-482-0x0000000000400000-0x0000000000854000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4900-483-0x00000000025A0000-0x000000000264B000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4900-471-0x0000000000400000-0x0000000000854000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4900-463-0x00000000025A0000-0x000000000264B000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4900-461-0x0000000000400000-0x0000000000854000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4900-366-0x0000000000400000-0x0000000000854000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4920-307-0x0000000007060000-0x0000000007082000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4920-317-0x0000000000400000-0x0000000000854000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4920-301-0x0000000000400000-0x0000000000854000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4988-292-0x0000000005120000-0x0000000005146000-memory.dmp
                                                                                                                                                                              Download